CVE-2026-36952 identifies an SQL injection vulnerability in Sourcecodester Online Thesis Archiving System v1.0, specifically in the /otas/admin/curriculum/manage_curriculum.php file. The vulnerability is characterized by improper sanitization of SQL inputs, enabling an attacker with high privileges to execute crafted SQL queries. The CVSS score of 2.7 reflects a low severity impact with network attack vector, low complexity, and no user interaction required. The vulnerability impacts confidentiality to a limited extent but does not affect integrity or availability.

An attacker with high privileges can exploit this SQL injection vulnerability to read limited data from the database. There is no indication of impact on data integrity or system availability. No known exploits are reported in the wild, and the overall impact is considered low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is documented, users should monitor vendor communications for updates. Until a patch is available, restrict access to the affected file and ensure that only trusted administrators have high privilege access to mitigate exploitation risk.